{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447) · updates",
  "home_page_url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447",
  "feed_url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/feed.json",
  "description": "An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files.",
  "language": "en",
  "_pwn": {
    "slug": "nextcloud-collabora-built-in-code-server-cve-2026-110447",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/feed.xml",
    "llms": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447/llms.txt",
    "json": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-10-14-a89db96e",
      "url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-10-14-a89db96e",
      "title": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): CVE-2026-110447 is published, noting exploitation in the wild in September and October 2026.",
      "content_text": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): CVE-2026-110447 is published, noting exploitation in the wild in September and October 2026.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
      "date_published": "2026-10-14T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-10-03-ae22d75d",
      "url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-10-03-ae22d75d",
      "title": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): A Nextcloud forum post warns built-in CODE users to update ASAP after web shells were found on servers.",
      "content_text": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): A Nextcloud forum post warns built-in CODE users to update ASAP after web shells were found on servers.\n\nSource: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516",
      "date_published": "2026-10-03T00:00:00.000Z",
      "external_url": "https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-09-11-029c6c66",
      "url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-09-11-029c6c66",
      "title": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): A hosting provider reports successful attacks via richdocumentscode proxy.php on GitHub, the first logged on Sep 10.",
      "content_text": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): A hosting provider reports successful attacks via richdocumentscode proxy.php on GitHub, the first logged on Sep 10.\n\nSource: https://github.com/CollaboraOnline/richdocumentscode/issues/354",
      "date_published": "2026-09-11T00:00:00.000Z",
      "external_url": "https://github.com/CollaboraOnline/richdocumentscode/issues/354",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-09-11-2c654d4c",
      "url": "https://pwn.watch/i/nextcloud-collabora-built-in-code-server-cve-2026-110447#2026-09-11-2c654d4c",
      "title": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): Collabora releases richdocumentscode 26.4.303 with the fix.",
      "content_text": "Attackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447): Collabora releases richdocumentscode 26.4.303 with the fix.\n\nSource: https://github.com/CollaboraOnline/richdocumentscode/releases/tag/26.4.303",
      "date_published": "2026-09-11T00:00:00.000Z",
      "external_url": "https://github.com/CollaboraOnline/richdocumentscode/releases/tag/26.4.303",
      "tags": [
        "critical"
      ]
    }
  ]
}